On September 29, 2026, a detailed security report was filed against a published ComfyUI custom node pack. The allegation is the kind of thing that keeps every self-hosted AI operator awake at night: a node pack installed through the official Comfy Registry ended up deploying a remote access trojan (RAT) and a cryptominer that ran unnoticed on the victim’s machine for at least nine days.
This is not a theoretical concern. ComfyUI’s node ecosystem has grown to well over a thousand community extensions, and the platform’s own history includes prior incidents where exposed instances were turned into cryptomining and proxy botnets. Understanding how a supply-chain compromise actually plays out — and what concrete steps you can take to detect and defend against it — is now a basic operational skill for anyone running ComfyUI locally.
This article is a documentation analysis of the public security report and adjacent industry research. It does not claim independent reproduction of the malware, but it pulls together the verifiable indicator-of-compromise (IOC) list, the attack mechanism, and the hardening steps that follow directly from the documented behavior.
What the Security Report Alleges
The report, filed as Comfy-Org/ComfyUI issue #16631, describes a Windows ComfyUI Desktop user who installed a node pack called champdev-comfyui-nodes version 0.5.2 through ComfyUI-Manager. The install method was cnr — meaning it was pulled from the Comfy Registry rather than manually cloned from a GitHub repository. That distinction matters, because many users reasonably assume that anything arriving through the official Manager is vetted.
The investigation traced a timeline that is worth reading in full. Twenty-five seconds after the pack was installed, pip installed a legitimate dependency (pywinpty, a real PyPI wheel that was not itself poisoned) that the malicious nodes would later abuse to spawn terminal sessions. Roughly seventeen minutes after that, an unsigned 18 MB executable named comfyui.exe appeared in the ComfyUI output directory and began connecting out to a mining pool at prl.kryptex.network:7048.
Over the following days, the attack escalated. A prestartup_script.py was written into the installed node’s directory — a persistence mechanism that the ComfyUI-Manager executes on every startup. Seven additional fake node packs with innocuous names (comfyui-protocolsuite, -technologysuite, -hardwaresuite, and so on) were created in custom_nodes, each containing nothing but an identical copy of that same prestartup_script.py.
By the time the machine was examined, around sixty hidden Python processes were running a command-and-control client, with their command lines disguised to look like ComfyUI/main.py and their payloads fed through stdin. Two WebSocket connections to a C2 server were established at the moment of incident response.
The Two Attack Primitives: Why This Node Pack Was a Backdoor by Design
Even setting aside the later-deployed malware, the report notes that the node pack itself exposed dangerous primitives as core features. It shipped a Terminal node (backed by terminal.py and pty_session.py) exposing a full shell through the ComfyUI API, and a FileManager node exposing arbitrary file read and write.
On a ComfyUI instance bound to 0.0.0.0 without authentication — a configuration that, according to Censys research from April 2026, is distressingly common — these two nodes alone constitute a complete remote backdoor. An attacker who can reach the API can execute arbitrary commands and read or write arbitrary files on the server without ever needing to drop a single binary.
This is the structural risk underneath the specific incident. Whether or not the pack shipped a bundled miner, any custom node in this “shell plus file manager” category turns an exposed, unauthenticated instance into an RCE target. The Snyk research team published a related deep-dive, Hacking ComfyUI Through Custom Nodes, that walks through exactly how node code can be abused to achieve remote code execution through input handling alone.
The Indicators of Compromise (IOC) List
If you are worried your own machine may have been affected, the most useful artifact in the report is the concrete IOC list. These are the values you can search for in your own environment:
Command-and-control and mining endpoints
- C2 WebSocket servers (port 8765):
78.17.213.213,121.127.34.173,103.20.235.215 - Mining pool:
prl.kryptex.network:7048(walletkrxYRP8WVQ, workerwin103, algorithm pearlhash) - Telemetry domain:
comfy-nodes-telemetry.champdev.in(parent domainchampdev.in) - Dynamic C2 feed URLs:
pastebin.com/raw/SiCPwKB6,telegra.ph/my-poem-09-25, andtelegra.ph/my-thoughts-09-25-2
File hashes
- RAT loader
prestartup_script.py(7 identical copies):cc01756015453c55c7a47b2482920b0a5908d56c131bb7713ca9e72b4ee494dc - Updated
prestartup_script.pyvariant:22581298a9e0257fd493c5cff92788ed5909836336b04e15c21abc2ffa2620eb - Decoded C2 client payload:
0fc2713a4404fc8d2ed282ce4379e765f33a37fef49fb593c7af4e5fb8431bbc - Miner executable:
4c571e7357373c362272cda7f960e128e77363813ce8a5b0ab289ae2573d8010
Persistence pack names to look for on disk
comfyui-protocolsuite,-technologysuite,-hardwaresuite,-opensuite,-contentsuite,-codingsuite,-connectsuite
Note that the fake persistence packs live on disk in custom_nodes, not necessarily on the Registry — so scanning your filesystem is more reliable than checking the Manager’s installed list alone.
How to Audit and Harden Your ComfyUI Install
You do not need to be a security researcher to meaningfully reduce your exposure. The following steps follow directly from the documented mechanics of the attack.
1. Search for the IOCs first
- Check
custom_nodesfor the seven fake pack directory names listed above. - Look for a
prestartup_script.pyanywhere inside your installed node directories and hash-match it against the values above. - Scan for any unsigned
*.exethat has appeared unexpectedly in your ComfyUI output directory. - Check your outbound connections for the C2 IPs,
prl.kryptex.network, or thechampdev.indomain.
2. Do not expose ComfyUI to the internet without authentication
If you need remote access, tunnel it (for example, through a VPN like Tailscale) rather than port-forwarding the raw server. An unauthenticated 0.0.0.0 bind is the single biggest amplifier of every exploit category listed above.
3. Review the custom nodes you actually have installed
Treat every custom node as code with full access to your machine. Skim its source for subprocess, os.system, socket, and pty usage before activating it. Nodes that legitimately need a shell (for ffmpeg pipelines, for example) should still be examined closely for where their command strings come from.
4. Watch the Manager’s security tooling
ComfyUI has introduced mechanisms to disable and remove malicious nodes, and third-party scanners like the neuregex/nodesafe project have emerged specifically because managers cannot review every pack by hand. Using a pre-install scanner as a second opinion is cheap insurance against the volume of new packs shipped every week.
What the Report Asks Send a Clear Signal
The requested actions in the report are as instructive as the IOC list. They ask the registry maintainers to unpublish the pack, audit the publisher’s other packs, add the loader-and-C2 indicators to automated scanning, and — most broadly — reconsider the policy of allowing shell and file-manager style RCE nodes in the first place.
That last point is the takeaway for operators. The security of your ComfyUI install is a function of three layers: what you expose to the network, what you install, and how much you trust before verifying. None of those layers is protected by the default setup. The good news is that all three are under your control, and the audit steps above cost minutes, not hours.
References
- GitHub issue #16631 — Security report: champdev-comfyui-nodes RAT + cryptominer
- Snyk — Hacking ComfyUI Through Custom Nodes
- Censys — Hackers Are Attempting to Turn ComfyUI Servers Into Cryptominers and Proxy Botnets
- ComfyUI Registry Standards — custom node security
- Related reading: ComfyUI “No Module Named” Errors: How to Diagnose and Fix Broken Custom Nodes
Leave a Reply